This Counter64, in Connections, counts HTTP connections detected to be tunneling other application traffic streams, such as instant-messenger traffic running over HTTP, requiring HTTP-layer deep packet inspection, accumulated since the last reboot. An admin uses it to catch applications disguising their real traffic as ordinary web traffic to slip past port-based rules. A noticeable rise here on a network that officially bans IM tools would suggest users are tunneling that traffic through HTTP to evade the policy.